Got OIDC working with Authentik

[FunDeckHermit]

Hi,

After reading both Authentik's and sftpgo docs I was sure they would be compatible somehow.
In Authentik, just make an OIDC provider and assign it to any empty application.

Here is my Docker compose config with hardcoded environment variables. The scopes are left empty, I did not need them.
docker-compose.yml file:

version: '3.6'

services:
  sftpgo:
    image: drakkan/sftpgo:edge
    container_name: sftpgo
    user: 1000:1000
    restart: on-failure
    environment:
      - SFTPGO_HTTPD__BINDINGS__0__OIDC__CONFIG_URL=https://auth.example.com/application/o/sftpgologin/
      - SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_ID=ab15afd912803945e9186adea5d6758d77df2f86
      - SFTPGO_HTTPD__BINDINGS__0__OIDC__USERNAME_FIELD=preferred_username
      - SFTPGO_HTTPD__BINDINGS__0__OIDC__ROLE_FIELD=sftpgo_role
      - SFTPGO_HTTPD__BINDINGS__0__OIDC__REDIRECT_BASE_URL=http://storage.example.com/
      - SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_SECRET=471f2f3edb0c298632a551d083f377399e88a5b965d56b991d1a0641944de409514e09e38c00e09c177ed6a0e1d2b87dadfc46c8b1d6f7be11459e2b70c416e9
    volumes:
      - ./data:/srv/sftpgo/data
      - ./config:/var/lib/sftpgo
      - /mnt:/srv/server-webdav
    ports:
      - 8080:8080
      - 2022:2022

After this, create a user in sftpgo that is known in Authentik. Then just click the button and login. It was surprisingly painless to get going.

[drakkan]

Thanks for sharing

[FunDeckHermit]

I saw some references to auto creation of users if they don't exist. Do you know if that made it into development?

[drakkan]

I saw some references to auto creation of users if they don't exist. Do you know if that made it into development?

You can create users using a pre-login hook. This is supported since v2.3.0

[FunDeckHermit]

Thanks, I'll check it out!

[fmahony]

Thanks for the example @FunDeckHermit ! Worked like a charm. By chance did you get the auto creation of users working between SFTPGo and Authentik? I created an 'identify provider login' event rule that calls an 'identity provider account check' action with the execute sync option. It's throwing the following errors that I can't figure out where they're coming from.

{"level":"error","time":"2023-06-27T18:48:46.787","sender":"eventmanager","message":"unable to handle IDP login event "IDP login user", err: invalid character 'r' in literal false (expecting 'a')"}
{"level":"debug","time":"2023-06-27T18:48:46.787","sender":"httpd","message":"unable to get the sftpgo user associated with oidc token: invalid character 'r' in literal false (expecting 'a')"}

[FunDeckHermit]

Decided to replace sftpGO with Filestash as it better fit my needs at the moment. Didn't get the pre-login hook working sadly. Glad my walk-though was helpful!